Prompt deletion server prerequisite

Deploy this Sirloin capability before merging the customer prompt-provenance change. It adds the private DeletePromptOwnerProvenance RPC and migration 184, while leaving customer capture, private reads, and Clerk handoff inactive. The migration installs four provenance tables and additive media guards; only deletion writes to these tables in this release. See the generated contract and apps/sirloin/internal/app/migrate/schema/184_prompt_provenance.sql.

The credential is SIRLOIN_PROMPT_DELETION_TOKEN. It defaults to unset, which makes the deletion method return Unavailable; it does not grant unauthenticated access. An authorized operator supplies the dedicated token through the approved secret configuration and deploys Sirloin. Verify that an unauthenticated call is denied and that an authenticated request with deliberately invalid deletion identity reaches validation and returns InvalidArgument without changing data. Other Sirloin RPCs remain unaffected by this token. Record the production version, migration 184 ledger entry, effective Sirloin database role’s access to the new schema and tables, and validation result before MR2 merges. The invalid-identity probe proves routing, authentication, and validation; it does not prove database erasure. Do not issue a real owner deletion just to smoke-test the route.

The handler acknowledges only after its transaction commits. That transaction stores an owner tombstone, disables capture, erases submission fields and parent references, and keeps repeated deletion events idempotent. promptdeletion.go returns a generic error if promptownerdeletion.go fails; private request and response bodies are excluded from logs.

Before MR2 captures provenance or cuts over its deletion caller, reverting to the old server is compatible with the additive schema. After that cutover, keep a caller that verifies Svix and waits for a durable DeletePromptOwnerProvenance acknowledgment, and roll Sirloin back no farther than this prerequisite release. If the RPC is unavailable, the caller must return a retryable failure until it is restored. The old main Brisket route acknowledges user.deleted without scrubbing, so it is not a safe rollback target after capture begins. Do not reverse migration 184 or clear owner tombstones: neither prior erasures nor deletion fences can be safely undone. Full MR2 must retain this migration’s number and exact DDL and merge its later capture code with the prerequisite’s deletion method without duplicate Go declarations.